Our commitment
One Verse AI Private Limited, operator of XDrop AI, is committed to handling personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules made under it.
Our roles
For account, authentication, usage and billing data, we are the Data Fiduciary. For personal data inside the documents customers upload to boardrooms, the customer is the Data Fiduciary and we act as a Data Processor, processing that data only on the customer's instructions.
Lawful processing
The DPDP Act recognises two grounds only: consent (§6) and the certain legitimate uses in §7. It has no “performance of a contract” ground, so we do not claim one. We rely on consent for the AI features, product communications, the referral programme and AI Education partner sharing - asked per purpose and withdrawable from your profile in one action; on §7(a) for running and securing your account, authenticating you, support and transactional messages; and on §7(c)/§7(d) for legal obligations such as GST invoice retention. See Privacy Policy §4 for the purpose-by-purpose mapping.
Notice and consent
We provide clear notice of what we collect and why at the point of collection (for example, during signup), and obtain consent where the DPDP Act requires it. Consent can be withdrawn at any time (which may limit use of the Service).
Data Principal rights
We enable the rights the DPDP Act grants to Data Principals: access to a summary of personal data and processing; correction, completion and updating; erasure; grievance redressal; nomination of another person to exercise rights on death or incapacity; and withdrawal of consent. Requests: business@xdrop.ai. You may also complain to the Data Protection Board of India.
Security safeguards
We implement reasonable technical and organisational safeguards, including tenant isolation enforced in the application authorisation layer, encryption in transit, access controls and audit logging. See Security.
Personal-data breach notification
We will notify affected Data Principals and the Data Protection Board of personal-data breaches as and to the extent required by the DPDP Act.
Retention and erasure
We retain personal data only as long as necessary for the purposes for which it was collected or as required by law, and delete or anonymise it thereafter.
Children
The Service is for users aged 18 and over; we do not knowingly process children's personal data.
Cross-border processing
Personal data is primarily processed in India; where service providers process data outside India, we act consistently with the DPDP Act and do not transfer data to territories restricted by the Government of India.
Grievance Officer
Grievance Officer - One Verse AI Private Limited
205, Morya Classic, CTS No. 592, Off New Link Road, Andheri, Mumbai – 400053, Maharashtra, India
business@xdrop.ai